CVE-2023-31134mediumCWE-601

CVE-2023-31134: fallo de gravedad media en tauri-apps tauri

Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear tauri+ Monitorear tauri

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.8epss 0.5%
Tauri is software for building applications for multi-platform deployment. The Tauri IPC is usually strictly isolated from external websites, but in versions 1.0.0 until 1.0.9, 1.1.0 until 1.1.4, and 1.2.0 until 1.2.5, the isolation can be bypassed by redirecting an existing Tauri window to an external website. This is either possible by an application implementing a feature for users to visit arbitrary websites or due to a bug allowing the open redirect. This allows the external website access to the IPC layer and therefore to all configured and exposed Tauri API endpoints and application specific implemented Tauri commands. This issue has been patched in versions 1.0.9, 1.1.4, and 1.2.5. As a workaround, prevent arbitrary input in redirect features and/or only allow trusted websites access to the IPC.
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Productos afectados
tauri-apps · tauri
CVEs relacionadas — tauri-apps tauri

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-46171MEDIUMTauri vulnerable to path traversalEPSS 1.1%CVE-2022-39215HIGHThe readDir Endpoint Scope can be Bypassed With Symbolic Links in TauriEPSS 1.0%CVE-2023-34460MEDIUMTauri vulnerable to Regression on Filesystem Scope Checks for DotfilesEPSS 0.6%CVE-2022-41874LOWTauri Filesystem Scope can be Partially BypassedEPSS 0.5%CVE-2024-35222MEDIUMiFrames Bypass Origin Checks for Tauri API Access ControlEPSS 0.3%CVE-2026-42184MEDIUMTauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC CommandsEPSS 0.3%